1From bd6fa2c1d5c163ab94edaf2e62d18cdfee33f913 Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Thu, 9 Mar 2023 22:33:19 +0100 4Subject: [PATCH] malloc-fail: Fix memory leak in xmlXPathRegisterNs 5 6Found by OSS-Fuzz. 7 8Reference:https://github.com/GNOME/libxml2/commit/bd6fa2c1d5c163ab94edaf2e62d18cdfee33f913 9Conflict:NA 10--- 11 xpath.c | 15 +++++++++++++-- 12 1 file changed, 13 insertions(+), 2 deletions(-) 13 14diff --git a/xpath.c b/xpath.c 15index 56a59c1..e3a8c14 100644 16--- a/xpath.c 17+++ b/xpath.c 18@@ -5133,6 +5133,8 @@ xmlXPathRegisteredVariablesCleanup(xmlXPathContextPtr ctxt) { 19 int 20 xmlXPathRegisterNs(xmlXPathContextPtr ctxt, const xmlChar *prefix, 21 const xmlChar *ns_uri) { 22+ xmlChar *copy; 23+ 24 if (ctxt == NULL) 25 return(-1); 26 if (prefix == NULL) 27@@ -5147,8 +5149,17 @@ xmlXPathRegisterNs(xmlXPathContextPtr ctxt, const xmlChar *prefix, 28 if (ns_uri == NULL) 29 return(xmlHashRemoveEntry(ctxt->nsHash, prefix, 30 xmlHashDefaultDeallocator)); 31- return(xmlHashUpdateEntry(ctxt->nsHash, prefix, (void *) xmlStrdup(ns_uri), 32- xmlHashDefaultDeallocator)); 33+ 34+ copy = xmlStrdup(ns_uri); 35+ if (copy == NULL) 36+ return(-1); 37+ if (xmlHashUpdateEntry(ctxt->nsHash, prefix, copy, 38+ xmlHashDefaultDeallocator) < 0) { 39+ xmlFree(copy); 40+ return(-1); 41+ } 42+ 43+ return(0); 44 } 45 46 /** 47-- 482.27.0 49 50